Should OIDC subs be globally unique?

[Wessel, Keith]

I agree, but I believe Scott's point is what if the RP doesn't do what they "must" do. It's not much more work to scope the sub claim, thus saving headache later when you encounter an RP who (1) doesn't play by the rules and (2) doesn't care.

I'd be interested in hearing what others are doing, though. Are many making the sub claim globally unique, or are more just trusting in the spec?

Keith


-----Original Message-----
From: Alan Buxey <alan.buxey at myunidays.com> 
Sent: Friday, March 25, 2022 9:44 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Should OIDC subs be globally unique?

hi,

If a relying party consumes identities from multiple operators, then it must combine the sub and iss claim to create a globally unique identifier. ie scoping isnt in the role of the Identity Provider (their role is just to ensure the subs are unique and don't change :).
- obviously this brings into play issues such as what happens
if/(when!) the ISS changes.....

alan